How Did Aqua Catch a Cryptomining Attack Hiding in Memory?
Get Started

Aqua Nautilus Research Blog

Nautilus focuses on cybersecurity research of the cloud native stack, missioned to uncover new vulnerabilities, threats and attacks that target containers, Kubernetes, serverless, and public cloud infrastructure.
How Did Aqua Catch a Cryptomining Attack Hiding in Memory?
TLDR: The attacks most likely to go undetected are the ones that never touch disk. They leave no files, trigger no signatures and are specifically engineered to evade the scanners and sensors most organizations depend on. Aqua’s runtime behavioral detection engine identified a multistage fileless cryptojacking campaign in a customer environment and surfaced malicious activity …
Read more
Top Research Blogs
AI-Generated Malware in Panda Image Hides Persistent Linux Threat
AI-Generated Malware in Panda Image Hides Persistent Linux Threat thumbnail
AWS CDK Risk: Exploiting a Missing S3 Bucket Allowed Account Takeover
Security Threat
AWS CDK Risk: Exploiting a Missing S3 Bucket Allowed Account Takeover thumbnail
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources
Security Threat
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources thumbnail
Can You Trust Your VSCode Extensions?
Can You Trust Your VSCode Extensions? thumbnail
Phantom Secrets: Undetected Secrets Expose Major Corporations
Security Threat
Phantom Secrets: Undetected Secrets Expose Major Corporations thumbnail
SECURITY RESEARCH
Critical CVE in React Server Components Actively Exploited
CVE-2025-55182
A newly disclosed vulnerability in React Server Components (RSC) dubbed as CVE-2025-55182, and also known as React2Shell, has introduced a severe remote code execution (RCE) vector impacting applications built with React 19 and frameworks that rely heavily on RSC, most notably Next.js.
Read more
SECURITY RESEARCH
Kaiji Malware: Anatomy, Persistence and Detection
Kaiji malware has emerged as a significant threat in recent years, particularly targeting Linux-based servers and IoT devices. This malware is designed to exploit internet connected services and devices to gain unauthorized access to systems. Once inside, Kaiji establishes persistence through various techniques, including creating system services and modifying system configurations.
Read more
Get Security Threat Alerts
SECURITY RESEARCH
AI-Generated Malware in Panda Image Hides Persistent Linux Threat
The line between human and machine-generated threats is starting to blur. Aqua Nautilus recently uncovered a malware campaign that hints at this unsettling shift. Koske, a sophisticated Linux threat, shows clear signs of AI-assisted development, likely with help from a large language model. With modular payloads, evasive rootkits, and delivery through weaponized image files, Koske …
Read more
SECURITY RESEARCH
Shadow Roles: AWS Defaults Can Open the Door to Service Takeover
Security Threat
What if the biggest risk to your cloud environment wasn’t a misconfiguration you made, but one baked into the defaults? Our research uncovered security concerns in the deployment of resources within a few AWS services, specifically in the default AWS service roles. These roles, often created automatically or recommended during setup, grant overly broad permissions, …
Read more
SECURITY RESEARCH
Tomcat in the Crosshairs: New Research Reveals Ongoing Attacks
News headlines reported that it took just 30 hours for attackers to exploit a newly discovered vulnerability in Apache Tomcat servers. But what does this mean for workloads relying on Tomcat? Aqua Nautilus researchers discovered a new attack campaign targeting Apache Tomcat. In this blog, we shed light on newly discovered malware that targets Tomcat …
Read more
SECURITY RESEARCH
Stopping Sobolan Malware with Aqua Runtime Protection  
Aqua Nautilus researchers have discovered a new attack campaign targeting interactive computing environments such as Jupyter Notebooks. The attack consists of multiple stages, beginning with the download of a compressed file from a remote server. Once executed, the attacker deploys several malicious tools to exploit the server and establish persistence. This campaign poses a significant …
Read more
SECURITY RESEARCH
OPA Gatekeeper Bypass Reveals Risks in Kubernetes Policy Engines
Security Threat
Implementing Kubernetes securely can be a daunting task. Fortunately, there are tools in the K8s toolshed that provide out-of-the-box solutions using a single click. One such tools is OPA Gatekeeper. It is a great out-of-the-box security checkpoint to enforce security policies on Kubernetes. But are users using it correctly? Do they understand its limitations? Our …
Read more
SECURITY RESEARCH
300,000+ Prometheus Servers and Exporters Exposed to DoS Attacks
Security Threat
In this research, we uncovered several vulnerabilities and security flaws within the Prometheus ecosystem. These findings span across three major areas: information disclosure, denial-of-service (DoS), and code execution.  We found that exposed Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API keys.   
Read more
SECURITY RESEARCH
Matrix Unleashes A New Widespread DDoS Campaign
Security Threat
Aqua Nautilus researchers uncovered a new and widespread Distributed Denial-of-Service (DDoS) campaign orchestrated by a threat actor named Matrix. Triggered by activities detected on our honeypots, this investigation dives deep into Matrix’s methods, targets, tools, and overall goals.   
Read more
SECURITY RESEARCH
Threat Actors Hijack Misconfigured Servers for Live Sports Streaming
Security Threat
To keep up with the ever-evolving world of cybersecurity, Aqua Nautilus researchers deploy honeypots that mimic real-world development environments. During a recent threat-hunting operation, they uncovered a surprising new attack vector: threat actors using misconfigured servers to hijack environments for streaming sports events. By exploiting misconfigured JupyterLab and Jupyter Notebook applications, attackers drop live streaming …
Read more
SECURITY RESEARCH
TeamTNT’s Docker Gatling Gun Campaign
Security Threat
Long time no see, Aqua Nautilus researchers have identified a new campaign in the making by TeamTNT, a notorious hacking group. In this campaign, TeamTNT appears to be returning to its roots while preparing for a large-scale attack on cloud native environments. The group is currently targeting exposed Docker daemons to deploy Sliver malware, a …
Read more
Page 1 of 1112345Next ›
Need to secure enterprise workloads?

Aqua Cloud Native Application Protection Platform (CNAPP)

Go cloud native with the experts!

Get Demo